Amendment Accompanying RCE in Response to Office Action of August 2 1 , 2009 

Application No. 10/781,913 
Attorney Docket 2500.0002C (INP0005-US) 

REMARKS 

Claims 1-16 remain pending in this application. Claims 1, 8 and 12 have been amended 
hereby. Support for the amendments to the claims can be found throughout the specification, 
and in particular, paragraphs [0020] and [0021] thereof. No new matter has been presented. For 
the reasons stated below, Applicants respectfully submit that all claims pending in this 
application are in condition for allowance. 

In the Office Action dated August 21, 2009, claims 1-16 were rejected under 35 U.S.C. 
§ 103(a) as being unpatentable over Allison et al. (WO 200271234 A) ("Allison") in view of 
Gould et al. (U.S. 2004/0199592 Al) ("Gould") and further in view of Wolczko et al. (U.S. 
6,728,738) ("Wolczko"). This ground of rejection is respectfully traversed. 

The presently claimed invention is directed to methodologies for keeping track of 
message traffic and raising an alarm when a number of messages received from a particular 
source or destined for a particular destination exceed a predetermined threshold. In order to 
reduce the number of false alarms that may be produced due to unabated incrementing of 
counters associated with sources or destinations, embodiments of the present invention provide 
for, e.g., reducing source counters in accordance with a specific methodology. 

Specifically, as messages are received, a timestamp is added to an array of timestamps 
and a source address counter is incremented for each entry so added. As a result, the array of 
timestamps includes multiple entries for each source address ("wherein the array of timestamps 
includes more than two timestamps for a given source address"). 

It is acknowledged in the paragraph bridging pages 3 and 4 of the Office Action dated 
August 21, 2009 that neither Allison nor Gould teaches an array of timestamps including more 
than two timestamps for a given source, or iterating through the array to remove entries therein. 
For these aspects of the claimed invention the Office Action cites to Wolczko. 

Wolczko discloses a method for "lifetime analysis" of objects in a garbage-collected 
system, wherein "reference counts" are maintained for each object in an object graph. Reference 
counts are stored values that indicate the number of incoming pointers to a given object. 
Wolczko at col. 3, lines 40-43 and Figs. 2 and 3. Fig. 3 of Wolczko illustrates a problem in 
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which even though the reference counts of objects 302, 304 and 306 in cycle 300 are all non- 
zero, those objects may nevertheless be dead as none of the objects in the cycle is, in fact, 
reachable from a root. Wolczko at col. 3, lines 59-65. To identify the dead objects in such a 
cycle, Wolczko discloses using a "tracing collector," such as mark-sweep collector, "to detect 
when objects are cyclic garbage." Wolczko at col. 4, lines 56-59. Then, to figure out precisely 
when a cycle (and objects therein) actually died, timestamps of changes to the cycles are 
examined in reverse chronological order. Wolczko at col. 4, lines 1-5. The lifetime of a given 
object may then be determined based on the time it was created and the time it dies. Wolczko at 
col. 4, line 67 to col. 5, line 5. 

Significantly, in Wolczko, the timestamp values have to do with when an object is 
pointed to. As such, the reference count in Wolczko need not and, in fact, does not keep track of 
which other object(s) pointed to a given object. In other words, Wolczko does not track sources 
at all. Consequently, Wolczko does not disclose an array of timestamps having "more than two 
timestamps for a given source ," as is required by the claims, since Wolczko does not have any 
idea what source (other object) has caused the reference count to be incremented. As a result, 
Wolczko does not overcome the acknowledged deficiencies of Allison and Gould. For this 
reason alone, the claims pending in this application should be allowable. 

Notwithstanding the foregoing, and in an effort to accelerate the prosecution of this 
application, Applicant has further amended the independent claims to recite yet another specific 
detail of the novel message traffic tracking methodology of the present invention. Specifically, 
the claims now require that when entries in the timestamp array that are older than a fixed 
window size are removed, other entries are left in the array of timestamps that are not older than 
the fixed window size ("removing entries in the timestamp array that are older than a fixed 
window size while leaving entries in the array of timestamps that are not older than the fixed 
window size "). At the same time, the source counter is decremented for each entry so removed. 

This newly added limitation is consistent with, e.g., Table 2 in paragraph [0021] of the 
instant specification, which shows that even after removing a certain number of entries (see 
"Number Removed" column), entries still remain in the array (see "Ending Total" column). 
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Wolczko does not disclose anything of this sort. At best, Wolczko implies that once it is 
determined that an object or cycle is "dead," then there is no need to reserve memory for those 
elements. As such, all information associated with "dead" objects or cycles would be deleted. 
As explained in the background section of Wolczko, "garbage collection refers to the recovery of 
pooled computer storage that is being used by a program when that program no longer needs the 
storage." Wolczko at col. 1, lines 13-15. Then, in the brief description of the invention section, 
Wolczko states, "[fjor each timestamp found, the corresponding object and any object reachable 
from the corresponding object are indicated as dead. These objects are then removed from the 
set of cyclic garbage ." Wolczko at col. 2, lines 7-10 (emphasis added). 

Thus, even if Wolczko were combinable to obtain the requirement of the recited 
timestamp array ("more than two timestamps for a given source"), which Applicant does not 
concede, such a combination would never result in a methodology that keeps or leaves 
timestamp entries after other entries are removed or deleted. 

Finally, and contrary to the assertion made in the Office Action, Gould does not disclose 
decrementing a source counter when entries in the array of timestamps are removed, as required 
by the claims. Gould only discloses incrementing a message counter. See, e.g., paragraph 
[0046] of Gould. If the message rate calculated in Gould is above a threshold, then "remedial 
action" is taken, including, e.g., discarding or blocking emails or delaying emails. See, e.g., 
paragraph [0049] of Gould. However, there is no disclosure regarding decrementing the 
message counter as a result of any of those actions. Accordingly, Gould does not disclose an 
expressly required element of the claims. 
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In view of the forgoing, all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone applicants' undersigned representative at the number listed below. 



Dated: February 23, 2010 Respectfully submitted by: 

Edell, Shapiro & Finnan, LLC /Lawrence D. Eisen/ 

Customer No. 27896 Lawrence D. Eisen 

1901 Research Boulevard, Suite 400 Reg. No. 41 009 
Rockville, MD 20850 
(301)424-3640 
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